{"id":48484299,"url":"https://github.com/denial-web/covernor-platform","last_synced_at":"2026-04-07T09:03:49.566Z","repository":{"id":345460100,"uuid":"1185945500","full_name":"denial-web/covernor-platform","owner":"denial-web","description":"AI Governance Layer — Control what AI is allowed to do, not just what it says. Policy engine, capability tokens, dual approval, hash-chain audit.","archived":false,"fork":false,"pushed_at":"2026-03-19T07:33:07.000Z","size":504,"stargazers_count":2,"open_issues_count":8,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-19T22:40:19.905Z","etag":null,"topics":["ai-governance","ai-safety","compliance","enterprise-ai","fintech","human-in-the-loop","llm-orchestration","open-source","policy-engine","typescript"],"latest_commit_sha":null,"homepage":"https://github.com/denial-web/covernor-platform#readme","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/denial-web.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-19T05:14:46.000Z","updated_at":"2026-03-19T07:59:48.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/denial-web/covernor-platform","commit_stats":null,"previous_names":["denial-web/covernor-platform"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/denial-web/covernor-platform","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denial-web%2Fcovernor-platform","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denial-web%2Fcovernor-platform/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denial-web%2Fcovernor-platform/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denial-web%2Fcovernor-platform/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/denial-web","download_url":"https://codeload.github.com/denial-web/covernor-platform/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/denial-web%2Fcovernor-platform/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31506598,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-07T03:10:19.677Z","status":"ssl_error","status_checked_at":"2026-04-07T03:10:13.982Z","response_time":105,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-governance","ai-safety","compliance","enterprise-ai","fintech","human-in-the-loop","llm-orchestration","open-source","policy-engine","typescript"],"created_at":"2026-04-07T09:03:49.500Z","updated_at":"2026-04-07T09:03:49.560Z","avatar_url":"https://github.com/denial-web.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Covernor — AI Governance Layer\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)\n[![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178c6.svg)](https://www.typescriptlang.org/)\n[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-339933.svg)](https://nodejs.org/)\n[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](./CONTRIBUTING.md)\n\n**Control what AI is allowed to *do* — not just what it says.**\n\n---\n\n## Why This Exists\n\nAI agents are unsafe without execution control. LangChain, CrewAI, and AutoGen let LLMs call tools directly — the AI is both the brain and the hands. One hallucinated function call can delete a database, transfer funds to the wrong account, or leak customer data.\n\nCovernor separates **planning** from **execution**. The AI proposes. A deterministic policy engine decides. Cryptographic tokens authorize. Humans approve what matters. Everything is audit-logged.\n\n---\n\n## How It Works\n\n```\n              ┌──────────────┐\n Objective ──►│   Advisor    │  LLM (GPT-4o / Claude / Ollama / any)\n              │              │  Proposes actions — zero execution rights\n              └──────┬───────┘\n                     ▼\n              ┌──────────────┐\n              │    Critic    │  Blocks prompt injection, SQL injection,\n              │              │  data exfiltration before it reaches policy\n              └──────┬───────┘\n                     ▼\n              ┌──────────────┐\n              │  Covernor    │  Deterministic policy engine (no LLM)\n              │              │  APPROVE · CONSTRAIN · ESCALATE · REJECT\n              └──────┬───────┘\n                     ▼\n              ┌──────────────┐\n              │   Operator   │  Sandboxed execution with capability tokens\n              │              │  Single-use, TTL-bound, ECDSA-signed\n              └──────────────┘\n```\n\nThe LLM never touches the execution layer. The Covernor never uses an LLM. This separation is the core security guarantee.\n\n---\n\n## Core Features\n\n| Feature | What It Does |\n|---|---|\n| **Policy Engine (Default Deny)** | JSON-configurable rules. Unknown actions are blocked, not allowed. No LLM in the decision path. |\n| **Capability Tokens (ECDSA)** | Every approved action gets a single-use, TTL-bound, scope-bound cryptographic token. The Operator won't execute without one. |\n| **Dual Approval (K-of-N)** | High-risk actions require multiple human approvers. Anti-self-dealing — same person can't approve twice. |\n| **Hash-Chain Audit Log** | SHA-256 chained, append-only, tamper-evident. Every decision, approval, and execution is recorded with full context. |\n| **Velocity Limiting** | Per-tenant and per-recipient rate guards. Atomic Redis Lua scripts. Fails closed if Redis is down. |\n| **Critic Layer** | Deterministic pattern detection for SQL injection, prompt injection, data exfiltration, and sensitive data leakage. |\n| **Operator Contracts** | Each tool declares max execution time, max rows, rate limits, and required idempotency. Enforced at runtime. |\n| **RBAC** | JWT + DB-backed roles (admin, approver, viewer, operator). No self-declared privileges. |\n| **LLM Flexibility** | Swap providers via UI or env vars. Supports OpenAI, Anthropic, Ollama, LM Studio, vLLM, or any OpenAI-compatible API. Works without any LLM (mock mode). |\n\n---\n\n## Example: AI Refund System\n\nA bank deploys an AI assistant that can issue refunds:\n\n```\nCustomer: \"I was charged twice for order #4521\"\n```\n\n| Amount | Covernor Decision | What Happens |\n|---|---|---|\n| $12 | `APPROVE` | Refund executes automatically. Audit logged. |\n| $250 | `APPROVE_WITH_CONSTRAINTS` | Refund executes with injected reason code. Manager notified. |\n| $5,000 | `BLOCK_AND_ESCALATE` | Blocked. Two managers must approve in the console. 4-hour expiry. |\n| $50,000 | `REJECT` | Hard reject. Velocity limit triggered. Flagged for review. |\n\nThe AI never decides the outcome. The policy engine does.\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- **Node.js** \u003e= 18\n- **Redis** — `brew services start redis` / `docker run -d -p 6379:6379 redis`\n\n### Setup \u0026 Run\n\n```bash\ngit clone https://github.com/denial-web/covernor-platform.git\ncd covernor-platform\nnpm run setup    # install deps, create .env, init database\nnpm run dev      # starts backend (port 3000) + frontend (port 5173)\n```\n\nOpen **http://localhost:5173** → Covernor Approval Console.\n\n### Try the Demo\n\n```bash\nnpm run demo-escalation\n```\n\nInjects a high-risk \"Transfer $15,000\" task. Watch it get blocked, inspect the rejection reason in the console, and click **Approve Override** to see a capability token get minted.\n\n### Connect an LLM (Optional)\n\nWorks out of the box with a mock strategy. To use a real LLM:\n\n```bash\n# Cloud\nACTIVE_LLM_PROVIDER=\"openai\"      # or \"anthropic\"\nOPENAI_API_KEY=\"sk-...\"\n\n# Local (Ollama)\nACTIVE_LLM_PROVIDER=\"ollama\"\nLLM_MODEL=\"llama3\"\n\n# Any OpenAI-compatible server\nACTIVE_LLM_PROVIDER=\"custom\"\nLLM_BASE_URL=\"http://localhost:1234/v1\"\nLLM_MODEL=\"my-model\"\n```\n\nOr configure via the **LLM Settings** panel in the Approval Console UI.\n\n---\n\n## Comparison\n\n| | Covernor | LangChain / LlamaIndex | CrewAI / AutoGen |\n|---|---|---|---|\n| **Execution Safety** | Deterministic firewall + crypto tokens | Up to the LLM | Up to the LLM |\n| **AI Role** | Advisory only, swappable | Core orchestrator | Swarm intelligence |\n| **Failure Handling** | Retry + rollback + human escalation | Try-catch | Agent debate |\n| **Audit Trail** | Cryptographic hash-chain | Basic logging | Basic logging |\n| **Human Oversight** | K-of-N dual approval UI | N/A | Variable |\n| **Vendor Lock-in** | None (self-hosted, open-source) | Framework-dependent | Framework-dependent |\n\n---\n\n## Production Readiness\n\n\u003e **Honest status: This is a governance framework, not a turnkey product.**\n\n### What's real and working\n- Deterministic policy engine with default-deny\n- ECDSA capability tokens (single-use, TTL-bound)\n- Hash-chain audit logs with financial fields\n- K-of-N dual approval with anti-replay\n- Redis velocity limiting (fails closed)\n- JWT + RBAC authentication\n- SQL/prompt injection detection\n- Operator contract enforcement\n- 43 security fixes across 6 audit rounds\n\n### What's still development-stage\n- SQLite database (swap to PostgreSQL for production)\n- In-memory crypto keys (integrate real KMS/HSM for production)\n- Mock payment execution (integrate your payment gateway)\n- Minimal test suite (needs comprehensive coverage)\n- No TLS configuration (add via reverse proxy or config)\n\n### What you'd add for regulated industries\n- Enterprise identity (OIDC/SAML + MFA)\n- HSM-backed key management (AWS KMS, Vault)\n- Database encryption at rest\n- Third-party penetration testing\n- Compliance documentation (SOC 2, FedRAMP)\n\nSee [docs/UPGRADE_PLAN.md](./docs/UPGRADE_PLAN.md) for the full production roadmap.\n\n---\n\n## Roadmap\n\n| Version | Focus | Status |\n|---|---|---|\n| **v0.1** | Core governance engine, policy engine, capability tokens, dual approval, audit chain | Current |\n| **v0.2** | PostgreSQL migration, OpenTelemetry, structured logging, API versioning | Planned |\n| **v0.3** | Enterprise identity (OIDC/SAML), KMS integration, field-level encryption | Planned |\n| **v0.4** | Agent memory, learning loops, fine-tuning pipeline, plugin system | Planned |\n\n---\n\n## Project Structure\n\n```\n├── src/\n│   ├── api/              # Express routes, auth, rate limiting, RBAC\n│   ├── core/\n│   │   ├── minister/     # Advisor: LLM planner + provider adapters\n│   │   ├── critic/       # Injection detection + schema validation\n│   │   ├── governor/     # Deterministic policy engine\n│   │   ├── operator/     # Sandboxed executor + tool implementations\n│   │   ├── workflow/     # BullMQ orchestration coordinator\n│   │   ├── policy/       # Capability registry\n│   │   └── crypto/       # ECDSA signing, AES-256-GCM encryption\n│   ├── db/               # Prisma client, hash-chain audit logger\n│   └── workers/          # Reconciliation, escalation, audit snapshot\n├── approval-console/     # React + Vite frontend\n├── docs/                 # Architecture, setup guide, upgrade plan\n├── prisma/               # Database schema\n└── tests/                # Unit and integration tests\n```\n\n---\n\n## Documentation\n\n- **[Setup Guide](./docs/SETUP.md)** — Full installation for macOS, Linux, Windows (WSL)\n- **[Architecture](./docs/architecture.md)** — System design and data flow\n- **[Interfaces](./docs/interfaces.md)** — API contracts and schemas\n- **[Upgrade Plan](./docs/UPGRADE_PLAN.md)** — Production roadmap with effort estimates\n\n---\n\n## Contributing\n\nWe welcome contributions. See **[CONTRIBUTING.md](./CONTRIBUTING.md)** for guidelines.\n\nThe most impactful areas right now:\n- PostgreSQL adapter and migration scripts\n- Additional operator tools (Stripe, Twilio, AWS)\n- Test coverage (unit, integration, security)\n- Documentation and examples\n\n---\n\n## License\n\n[MIT](./LICENSE) — Use it, fork it, build on it.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdenial-web%2Fcovernor-platform","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdenial-web%2Fcovernor-platform","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdenial-web%2Fcovernor-platform/lists"}